On December 17, the Pine Bluff School District wired $3.2 million to what they believed was their contractor on the new high school project. 

A recent report on the Pine Bluff school district phishing scam

It wasn’t. 

The invoice was real. The vendor was real. The email thread was real. The wiring instructions? Not real. 

Here’s the part that should stop you cold: a cybercriminal had quietly slipped into the existing email conversation between the district, the architect, and East Harding Construction — the firm actually managing the $74 million high school build. Same names. Same project. Same tone. They just inserted one new message that said, in effect, “please wire it to this account instead.” 

And just like that — $3.2 million, gone. 

The fraud wasn’t discovered until someone at the district picked up the phone to confirm receipt. The contractor’s response? “We never asked you to wire that.” 

We’re writing about this because Pine Bluff is about 45 minutes south of us, and what happened to that district can — and does — happen to small and mid-sized businesses across Arkansas every week. Most of them just don’t make the news. 

When most business owners picture a cyberattack, they picture someone in a hoodie hammering on a keyboard, breaking through a firewall. 

That’s not what this was. 

There was no firewall breach in any meaningful sense. No ransomware. No locked-up servers. No blinking red warnings. 

Just a normal email. In a normal conversation. On a normal day. 

It didn’t feel like an attack. It felt like Tuesday. 

And that’s exactly why it worked. 

This style of attack has a name: business email compromise, or BEC. The FBI tracks billions of dollars in losses from it every year. The version that hit Pine Bluff is one of the nastier flavors — sometimes called email thread hijacking or conversation hijacking. 

Here’s the rough sequence: 

The defense most businesses think they have — “we’d notice a weird email” — doesn’t apply here. The email isn’t weird. The email is from a real person, on a real thread, about a real invoice you were already expecting to pay. 

If you run a business with somewhere between 10 and 200 employees, you are squarely in the sweet spot for this kind of fraud. 

Big enterprises have entire security teams, dual-approval workflows for every wire, and software that flags anomalies in payment behavior. Tiny businesses don’t move enough money to be worth the effort. 

You’re in the middle. You move enough money to matter, but you probably don’t have a dedicated security team. Your finance person is probably also your HR person and your office manager. Your processes for handling vendor payments are probably consistent enough to function — but loose enough that a well-crafted email could slide right through. 

That’s not an insult. That’s how real businesses run: 

It just also happens to be exactly what attackers are counting on. 

Here’s the part we keep coming back to. 

No one asked: “Should we double-check this?” 

Not because they didn’t care. Not because they weren’t smart. But because asking felt unnecessary. It might slow things down. It might seem like they didn’t trust the vendor. 

So the question never got asked. 

The difference between a normal day and a $3.2 million mistake is usually one small moment of hesitation that either happens — or doesn’t. 

We’re a tech company. You’d probably expect us to tell you the answer is some new product. 

It isn’t. Not really. 

After the incident, Pine Bluff’s superintendent listed the changes they made. Read this list carefully — it’s almost entirely about process, not technology: 

Notice what’s not on that list: a fancier firewall. A new antivirus. A magic AI tool. 

The fix is almost embarrassingly simple. Before you change how you pay a vendor — or send a wire of any meaningful size — you pick up the phone and call the vendor at a number you trusted before this email showed up. That’s it. That’s the control. 

For your business, that translates to a few grounded, very human practices: 

Verify outside of email. If money is moving, confirmation happens by phone. Period. 

Use known contact info. Not the number in the email. The one you already trust. 

Normalize the pause. Your team should feel empowered to slow things down — not guilty for it. 

Document the process. If it’s not written down, it’s optional. And optional controls don’t hold up under pressure. 

Most businesses don’t have a tech problem here. They have a clarity problem. 

It’s the quiet assumptions: 

But Pine Bluff didn’t lose $3.2 million because someone was reckless. They lost it because everything looked right enough to keep moving. 

A business where: 

That’s not paranoia. That’s just a business that doesn’t fall apart when something unexpected shows up in the inbox. 

If you’re even slightly wondering “would we catch that?” — that’s the right instinct. And honestly? That’s where the most valuable conversations start. 

At BizTek, we sit down with teams just like yours and walk through: 

No scare tactics. No overcomplicated tech talk. Just clarity on where you stand and what’s worth doing about it. 

Book a 20-minute walkthrough →

Because peace of mind isn’t about hoping nothing happens. 

It’s about knowing exactly what would happen if it did.